Threat Actors Advancing Email Phishing Attacks to Bypass Security Filters
Cybercriminals are continuously enhancing their email phishing tactics by reintroducing legacy methods alongside advanced evasion techniques to bypass automated filters and human scrutiny.
Cybercriminals are continuously enhancing their email phishing tactics by reintroducing legacy methods alongside advanced evasion techniques to bypass automated filters and human scrutiny.
In 2025, attackers are refining traditional strategies, such as password-protected attachments and calendar invites, by incorporating new elements like QR codes, multi-stage verification chains, and live API integrations. These advancements extend the attack's lifecycle and exploit weaknesses in scanning tools and user trust.
Phishing emails often include PDF attachments. Instead of embedding clickable links, attackers now use QR codes within PDFs. Recipients scan these codes on mobile devices, which typically lack the same security controls as workstations. This method adds an extra layer of file handling, concealing phishing URLs.
Additionally, attackers utilize password-protected PDFs to evade automated scanning. The password may be provided in the same email or separately, emulating secure communication. This approach can deceive users into trusting the content, allowing attackers to harvest credentials or deploy malware.
These advancements extend the attack's lifecycle and exploit weaknesses in scanning tools and user trust.
Calendar-based phishing methods are re-emerging, particularly targeting B2B campaigns. Blank emails containing calendar invites with malicious links can prompt users to click on reminders days later, increasing the likelihood of compromise.
Phishing websites are also becoming more sophisticated. Simple campaigns may require users to navigate CAPTCHA verification chains before encountering a fake login page. This layered approach helps evade automated security scans by requiring human interaction.
Phishers are employing live-proxy techniques to bypass multi-factor authentication (MFA). A recent campaign involved emails impersonating a cloud storage provider, redirecting users to a look-alike domain that proxies interactions to the real service via API calls. This enables attackers to capture both passwords and one-time codes, granting full account access.
The mimicry includes familiar UI elements and default folders, enhancing the illusion of legitimacy and bypassing conventional email filters.
Organizations and users should treat unusual attachments with skepticism, verify links and domain names before clicking, and use advanced threat-hunting tools capable of inspecting encrypted files and multi-stage web interactions. Understanding the evolving nature of these attacks is crucial for maintaining robust defenses against increasingly sophisticated adversaries.
Based on reporting by GBHackers.